Andurin (@4ndur1n) 's Twitter Profile
Andurin

@4ndur1n

IT-Security, Cyber Threat Analyst

ID: 810447050466791425

calendar_today18-12-2016 11:30:09

142 Tweet

101 Followers

156 Following

Frank Boldewin (@r3c0nst) 's Twitter Profile Photo

(1/7) How to debug a malicious .net dll using #DNSPY Recently I got asked if it is possible to debug a malicious .net dll using DNSPY. Afaik there is no integrated debugger function for it, so here is my indirect approach. As an example I use the dll shown in the screenshot below

(1/7) How to debug a malicious .net dll using #DNSPY
Recently I got asked if it is possible to debug a malicious .net dll using DNSPY. Afaik there is no integrated debugger function for it, so here is my indirect approach. As an example I use the dll shown in the screenshot below
Alexandre Dulaunoy @adulau@infosec.exchange (@adulau) 's Twitter Profile Photo

A huge thank to Joseliyo for the work on converting automatically sigma rules into a MISP (@[email protected]) galaxy. I finally found the time to merge it in the default galaxies. The MISP galaxy will be updated at reach release automatically. #threatintel github.com/jstnk9/MISP/pu…

A huge thank to <a href="/Joseliyo_Jstnk/">Joseliyo</a> for the work on converting automatically <a href="/sigma_hq/">sigma</a> rules into a <a href="/MISPProject/">MISP (@misp@misp-community.org)</a> galaxy. I finally found the time to merge it in the default galaxies. The MISP galaxy will be updated at reach release automatically. 
#threatintel
github.com/jstnk9/MISP/pu…
Andurin (@4ndur1n) 's Twitter Profile Photo

Hey ATT&CK , why are there two different GH Projects for nearly the same content? github.com/mitre/cti and github.com/mitre-attack/a… Why does attack-stix-data contains the "x_mitre_version" and cti doesn't?

Florian Roth ⚡️ (@cyb3rops) 's Twitter Profile Photo

For anyone asked to pay $$$ for a compromise assessment with the #3CX IOCs & YARA rules You can use the free THOR Lite scanner to do the same. (it should even detect traces of the activity, like C2s in log files etc; Sigma scanning only in full version) nextron-systems.com/thor-lite/

abuse.ch (@abuse_ch) 's Twitter Profile Photo

SERVICE UPDATE | Today, Twitter has revoked our access to their authentication API. The impact is submissions to the abuse.ch platforms cannot be made. We are urgently working to find a different authentication method. Please bear with us - we'll update again

Alex (@alexanderjaeger) 's Twitter Profile Photo

🕶️🧐👀🥷🥁A new project by the Security Response team of Google: dfiq.org. It fills a gap I have seen for years, asking the same questions in similar investigations across analysts who might have different background and know how. 🕶️🧐👀🥷🥁

sigma (@sigma_hq) 's Twitter Profile Photo

We're pleased to announce the launch of our new website Access resources, documentation, and community projects to enhance your experience with the Sigma Rule Standard Special thx to Αⅼех for the hard work! Blog: medium.com/sigma-hq/intro… Explore now: sigmahq.io

We're pleased to announce the launch of our new website

Access resources, documentation, and community projects to enhance your experience with the Sigma Rule Standard

Special thx to <a href="/sifex/">Αⅼех</a> for the hard work!

Blog: medium.com/sigma-hq/intro…
Explore now: sigmahq.io
DCSO CyTec (@dcso_cytec) 's Twitter Profile Photo

#ShortAndMalicious Our researchers recently discovered an installer for the mandatory 🇷🇺Russian tax filling software "Spravki BK" (Справки БК) which was backdoored with #KONNI malware, generally attributed to 🇰🇵North Korean threat actors. 1/5

John Althouse (@4a4133) 's Twitter Profile Photo

I'm looking to contract someone who can convert JA4+ into Zeek scripts. Anyone know of any Zeek experts who could take on the effort?

DCSO CyTec (@dcso_cytec) 's Twitter Profile Photo

Our newest article provides a closer look at recent reporting on Volt Typhoon's "JDY" botnet management, which suggests that the threat actor uses Tor differently to what has been publicly documented so far. medium.com/@DCSO_CyTec/c4…

Scott Piper (@0xdabbad00) 's Twitter Profile Photo

CISA is requiring all Federal agencies to disconnect Ivanti products by Friday at midnight (Ivanti Connect Secure & Ivanti Policy Secure). This is roughly 48 hours notice, to not patch, but rip it out! Ivanti is an American company. This is unprecedented. cisa.gov/news-events/di…